An Image Forensics Glossary

A reference for the terms that appear across this blog and in the wider literature.

Core techniques

Error Level Analysis (ELA) — Re-saves an image at a known compression quality and visualises the difference, revealing regions with differing compression histories.

Photo-Response Non-Uniformity (PRNU) — A sensor’s unique fixed-pattern noise fingerprint, arising from manufacturing variation. Can attribute a photograph to a specific physical camera given reference images.

Copy-move forgery detection — Locates regions duplicated within a single image, typically used to clone out or multiply objects.

Splicing detection — Identifies regions imported from a different source image.

Demosaicing analysis — Examines the interpolation pattern left by a colour filter array. Edited regions often break the expected pattern.

Block artefact grid analysis — Checks whether JPEG 8×8 block boundaries align consistently across the frame. Misalignment indicates pasted content.

Compression terms

Quantisation table — The divisor matrix that determines how aggressively each DCT frequency is discarded. Varies by encoder and quality setting.

Double compression — The signature left when an image is JPEG-encoded more than once with different tables.

Chroma subsampling — Storing colour at lower resolution than luminance. Notated 4:4:4, 4:2:2 or 4:2:0.

Discrete Cosine Transform (DCT) — The frequency transform at the heart of JPEG, applied per 8×8 block.

Generative terms

GAN — Generative Adversarial Network. Two networks trained in opposition. Dominant before diffusion; leaves characteristic periodic upsampling artefacts.

Diffusion model — Generates by iteratively denoising random noise toward an image. Current state of the art.

Latent space — The compressed representation a model operates in. Artefacts introduced here propagate to output in structured ways.

Deepfake — Colloquially, any synthetic media depicting a real person; technically, face replacement or reenactment.

Neural rendering — Producing images from learned 3D scene representations rather than 2D generation.

Provenance terms

C2PA — Coalition for Content Provenance and Authenticity. The standards body behind Content Credentials.

Content Credentials — The user-facing name for C2PA signed manifests.

Chain of custody — Documented record of who held evidence, when, and what they did to it. Required for legal admissibility.

Hash — A fixed-length fingerprint of a file. Any change produces a different hash.

Evaluation terms

False positive — Authentic content flagged as manipulated.

False negative — Manipulated content passing as authentic.

Precision — Of everything flagged, the fraction genuinely manipulated.

Recall — Of everything genuinely manipulated, the fraction flagged.

Adversarial evasion — Deliberately post-processing manipulated content to defeat detection.